8823 matches found
CVE-2021-33502
CVE-2021-33502 affects the normalize-url package for Node.js. Concrete details show a ReDoS issue where data URLs trigger exponential backtracking, impacting versions: 4.x up to 4.5.1, 5.x up to 5.3.1, and 6.x up to 6.0.1. The vulnerability arises from an exponential-backoff/regex pattern in hand...
Deserialization of Untrusted Data
Amendment This was deemed not a vulnerability. Overview msgpack is an A space-efficient object serialization library for node.js Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the unpack function. N.B: this affects the NPM package msgpack only, NOT the...
ABPTTS - TCP Tunneling Over HTTP/HTTPS For Web Application Servers
A Black Path Toward The Sun TCP tunneling over HTTP for web application servers https://www.blackhat.com/us-16/arsenal.htmla-black-path-toward-the-sun Ben Lincoln, NCC Group, 2016 ABPTTS uses a Python client script and a web application server page/package1 to tunnel TCP traffic over an HTTP/HTTP...
Security Bulletin: Multiple vulnerabilities in Node.js affecting Rational Application Developer for WebSphere Software included in Rational Developer for i and Rational Developer for AIX and Linux
Summary Portions of Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i Modernization Tools, Java edition, and Rational Developer for AIX and Linux. Multiple Node.js vulnerabilities have been discovered that affect the Cordova platform...
Security Bulletin: Vulnerabilities in XStream, Java, OpenSSL, WebSphere Application Server Liberty and Node.js affect IBM Spectrum Control
Summary Multiple vulnerabiilities in XStream, Java, OpenSSL, WebSphere Application Server Liberty and Node.js may affect IBM Spectrum Control. The Java vulnerabilities were disclosed as part of the IBM Java SDK updates in October 2020 and January 2021. Vulnerability Details CVEID: CVE-2020-5258...
Security Bulletin: A security vulnerability in Node.js netmask module affects IBM Cloud Automation Manager
Summary A security vulnerability in Node.js netmask module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-28918 DESCRIPTION: Node.js netmask module is vulnerable to server-side request forgery, caused by the improper handling of mixed-format IP addresses. By using a...
Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused...
Security Bulletin: A security vulnerability in Node.js braces and netmask module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js braces and netmask module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2018-1109 DESCRIPTION: Node.js braces module is vulnerable to a denial of service, caused by a regular expression denial of servi...
Security Bulletin: A security vulnerability in Node.js braces and netmask module affects IBM Cloud Automation Manager
Summary A security vulnerability in Node.js braces and netmask module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2018-1109 DESCRIPTION: Node.js braces module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw. By using a...
Security Bulletin: A security vulnerability in Node.js pug and pug-code-gen module affects IBM Cloud Pak for Multicloud Management Managed Service.
Summary A security vulnerability in Node.js pug and pug-code-gen module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-21353 DESCRIPTION: Node.js pug and pug-code-gen could allow a remote attacker to execute arbitrary code on the system,...
Security Bulletin: A security vulnerability in Node.js netmask module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js netmask module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-28918 DESCRIPTION: Node.js netmask module is vulnerable to server-side request forgery, caused by the improper handling of mixed-format...
@27works/posto (2.0.2), @lluis/codo (>=2.1.2, <=2.1.3) +70 more potentially affected by CVE-2021-32818 via haml-coffee (>=1.4.1, <=1.14.1)
haml-coffee NPM version =1.4.1, =2.1.2, =0.0.2, =2.1.3, =0.0.1, =0.0.1, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2021-32818 Source advisory: OSV:GHSA-M7MF-VM62-7X3Q...
CVE-2021-23384
The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...
Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js
Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js Vulnerability Details CVEID: CVE-2020-8237 DESCRIPTION: Node.js json-bigint module is vulnerable to a denial of service, caused by a prototype pollution flaw. By adding or modifying Object properties, a remote attacker could...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID: CVE-2021-22884 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error when the allowlist includes localhost6. By controlling the victim's DNS serve...
Sifchain: Path Transversal inside saveContracts.js
Reference: https://portswigger.net/web-security/file-path-traversal Directory traversal also known as file path traversal is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data,...
Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an...
Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS in...
Security Bulletin: A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-23362 DESCRIPTION: Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial o...
Security Bulletin: A security vulnerability in Node.js xmldom and msgpack5 module affects IBM Cloud Pak for Multicloud Management Managed Service
Summary A security vulnerability in Node.js xmldom and msgpack5 module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-21366 DESCRIPTION: Node.js xmldom module could allow a remote attacker to bypass security restrictions, caused by improper...